CVE-2026-61250: Oracle Payroll Auth Bypass Vulnerability

CVE-2026-61250 Overview

CVE-2026-61250 is an access control weakness [CWE-284] in the Oracle Payroll component of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation grants unauthorized read access to critical Payroll data, up to full disclosure of all data accessible by the Payroll application.

Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability impacts confidentiality only, with no direct effect on integrity or availability.

Critical Impact
An authenticated network attacker can retrieve sensitive payroll records, including employee compensation and personally identifiable information, from affected Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite - Oracle Payroll 12.2.3
Oracle E-Business Suite - Oracle Payroll versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Payroll 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61250 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-61250

Vulnerability Analysis

The vulnerability resides in the Payroll component of Oracle E-Business Suite. Oracle classifies it under improper access control [CWE-284]. An authenticated user with limited privileges can send crafted HTTP requests to Payroll endpoints and access data that should be restricted by role-based controls.

Oracle characterizes exploitation as easy and network-reachable. Confidentiality impact is high, while integrity and availability are unaffected. The scope is unchanged, meaning the attacker operates within the same security authority as the vulnerable component.

Because Oracle Payroll stores sensitive employee data such as salaries, tax identifiers, and banking details, disclosure carries direct regulatory and financial consequences. The EPSS score is 0.248% at the 16th percentile, indicating low observed exploitation activity at publication.

Root Cause

The root cause is missing or insufficient authorization enforcement on Payroll HTTP-accessible functions. Access decisions do not correctly restrict which authenticated users may retrieve Payroll data. Oracle has not published the vulnerable code path, and no public proof-of-concept exists.

Attack Vector

The attack vector is a remote HTTP request from an authenticated session. The attacker requires a valid low-privileged Oracle E-Business Suite account. No user interaction is required, and the attacker does not need elevated privileges to obtain data restricted to Payroll administrators.

Exploitation typically involves issuing requests to Payroll servlets or REST endpoints that fail to verify the requester's Payroll authorization before returning data. See the Oracle Critical Patch Update advisory for vendor guidance.

Detection Methods for CVE-2026-61250

Indicators of Compromise

Unusual volumes of HTTP requests from low-privileged accounts targeting Oracle Payroll servlets or /OA_HTML/ endpoints.
Access log entries showing employee or payroll data queries from user sessions without Payroll role assignments.
Repeated enumeration patterns against Payroll URLs during off-hours or from unexpected source IPs.

Detection Strategies

Correlate Oracle E-Business Suite application audit logs with user role assignments to flag Payroll data reads by non-Payroll roles.
Enable and review the Oracle Sign-On Audit and Page Access Tracking features to identify unauthorized Payroll page views.
Deploy web application firewall rules to log and alert on anomalous HTTP methods or parameter patterns against Payroll URIs.

Monitoring Recommendations

Ingest Oracle E-Business Suite application server logs, database audit logs, and web tier access logs into a centralized SIEM for correlation.
Baseline normal Payroll access volumes per role and alert on statistical deviations.
Monitor privileged database queries against PAY_* and PER_* schema tables for access originating outside the Payroll application server.

How to Mitigate CVE-2026-61250

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.x instances running the Payroll module.
Audit user accounts with any level of Oracle E-Business Suite access and remove unnecessary or dormant accounts.
Review Payroll responsibility and role assignments to enforce least privilege.

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should follow the patch matrix in the Oracle Critical Patch Update - July 2026 advisory. All supported releases from 12.2.3 through 12.2.15 require patching.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier using allowlists and VPN-only access for internal users.
Enforce multi-factor authentication for all Oracle E-Business Suite accounts to reduce the risk of low-privileged account compromise.
Increase logging verbosity on Payroll modules until the Critical Patch Update can be deployed.

bash

# Configuration example - enable Sign-On Audit at FORM level in Oracle E-Business Suite
# Set the profile option via System Administrator responsibility:
#   Profile > System > Sign-On:Audit Level = FORM
# Then query recent Payroll form access:
sqlplus apps/<password> <<EOF
SELECT user_name, responsibility_name, form_name, start_time
FROM   applsys.fnd_login_resp_forms lrf
JOIN   applsys.fnd_logins l ON l.login_id = lrf.login_id
JOIN   applsys.fnd_user u   ON u.user_id  = l.user_id
WHERE  form_name LIKE 'PAY%'
AND    start_time > SYSDATE - 7
ORDER  BY start_time DESC;
EOF